Linux foundation automotive summit

Best Practices for Open SourceCompliance and Governance inAutomotive Kim Weins SVP, OpenLogic November 2011 © OpenLogic, Inc. - Licensed under CC-BY | 1

Agenda Open source in Automotive Why Comply? Challenges of Compliance Best practices © OpenLogic, Inc. - Licensed under CC-BY | 2

End-to-End Open Source ManagementEnabling Successful and Safe Open Source Adoption At Hundreds of Enterprises In the Data Center In the Cloud Software + Support + Services © OpenLogic, Inc. - Licensed under CC-BY | 3

Open Source in the Car © OpenLogic, Inc. - Licensed under CC-BY | 4 4

And Outside the Car Mobile Cloud-Based Apps Services © OpenLogic, Inc. - Licensed under CC-BY | 5 5

But Compliance is an Issue Developers List Scan Results 3-5x OSS licenses you OSS licenses you think you are using REALLY are using © OpenLogic, Inc. - Licensed under CC-BY | 6

Compliance in Mobile Apps 71% of Apps using Comply 29% Open Source under GPL, LGPL Do Not Comply and Apache 71% do not comply Source: OpenLogic Mobile Research 3/2011 © OpenLogic, Inc. - Licensed under CC-BY | 7 7

Why comply? © OpenLogic, Inc. - Licensed under CC-BY | 8 8

It’s The Right Thing to Do Proprietary Open Source Software Package License License © OpenLogic, Inc. - Licensed under CC-BY | 9 9

Supply Chain Customers Demand ItContract TermsLicensor shall disclose to Customer any Open Source included in the WorkProduct provided pursuant to this Agreement and shall warrant that WorkProduct complies with all of the relevant Open Source licenses. 10 10 © OpenLogic, Inc. - Licensed under CC-BY |

Legal Action Source: Ars Technica Source: cnet Source: The Inquirer 11 11 © OpenLogic, Inc. - Licensed under CC-BY |

Consumers Notice 12 12 © OpenLogic, Inc. - Licensed under CC-BY |

Loss of Your IP Open Source under “Copyleft” Your code Linking license Derivative work? Depends on the license and how you combine the code 13 13 © OpenLogic, Inc. - Licensed under CC-BY |

What are thechallenges? 14 14 © OpenLogic, Inc. - Licensed under CC-BY |

Three Challenges1. Bundled licenses2. SW development practices3. Supply chain complexity 15 15 © OpenLogic, Inc. - Licensed under CC-BY |

Bundled Licenses What most Reality people think Main Open Source Package Open Source Package Bundled Open Source Packages License Main License Bundled License Bundled License Bundled License 16 16 © OpenLogic, Inc. - Licensed under CC-BY |

Software Development Practices FREE! SourceForge Google Code Your Source Code GitHub and more…. 17 17 © OpenLogic, Inc. - Licensed under CC-BY |

Supply Chain Complexity Your Source Code 18 18 © OpenLogic, Inc. - Licensed under CC-BY |

ComplianceBest Practices (Be aware, not afraid) 19 19 © OpenLogic, Inc. - Licensed under CC-BY |

Compliance Best Practices1. Understand open source licensing2. Create an open source policy3. Track all open source usage – including from vendors4. Conduct a scan or audit of your code5. Develop a compliance checklist 20 20 © OpenLogic, Inc. - Licensed under CC-BY |

1. Understand OSS Licensing Official definition of OSS license – Approved by the Open Source Initiative (OSI) • http://www.opensource.org/ – Currently over 70 approved licenses – Key Criteria • Free distribution • Source code is available • Derived works are allowed • Non-discrimination Many other “non-OSI” open source licenses 21 21 © OpenLogic, Inc. - Licensed under CC-BY |

Categorizing Open Source Licenses Liberal Copyleft No Strings “Traditional” Additional Strings Attached Open Source Clauses MIT/X Original BSD GNU GPL GNU GPL v3 W3C Apache Software GNU LGPL GNU AGPL License Common Public Eclipse Public License License Mozilla Public License SISSL IBM Public License 22 22 © OpenLogic, Inc. - Licensed under CC-BY |

2. Create an Open Source Policy Things to include – Licenses allowed – Approval processes – Audit and compliance processes Considerations – Keep it lightweight – Don’t let fear guide you 23 23 © OpenLogic, Inc. - Licensed under CC-BY |

3. Track all Open Source Usage: Why? Know what you are using Identify opportunities for sharing or savings Legal & compliance Maintenance Support © OpenLogic, Inc. - Licensed under CC-BY | 24

Vendor Best Practices Contract Requirements – Disclosure – Approval – Warranties – Indemnification – Scanning/Audit requirements Best Practices – Discuss open source with them early in the project – Get list of open source early in development cycle – Get a final list of open source when they provide final code – Get source code from vendor if at all possible (not just binaries) – Either scan all incoming code that you plan to distribute or consider spot audits 25 25 © OpenLogic, Inc. - Licensed under CC-BY |

Getting Binaries vs Source Code Why you want to get source code from vendors – Source code scanning is more accurate than binary scanning – You can scan it and verify what open source is there – Your company must comply with open source licenses coming from vendors – Many vendors don’t have strong open source compliance programs – Relying on “manual, self-reporting” is extremely inaccurate If you accept binaries from vendors, consider the following – Does the vendor have an open source governance policy/process? – Does the vendor scan their own code? – Will the vendor supply you with results of scan? – Will the vendor warrant and indemnify around use of open source? – Is the vendor of sufficient size to make good on indemnification? – What is cost to you if the vendor gets it wrong? • Stop shipment? • Legal costs? • Reputation risks? 26 26 © OpenLogic, Inc. - Licensed under CC-BY |

Create “Risk Tiers” for Software You Provide Risk Tier 1 – Fundamental – Product doesn’t work without it – Examples: Car dashboard, Anything that runs the car Risk Tier 2 – Critical to “experience” – Product works without it, but not a great experience – Examples: Entertainment system Risk Tier 3 – Nice to haves – Examples: Optional “apps” or add-ons 27 27 © OpenLogic, Inc. - Licensed under CC-BY |

Align Vendor Requirements to Risk TierRisk Tier Acceptable Requirements FormatsRisk Tier 1 Source code You scanFundamentalRisk Tier 2 Source code or You scan or vendor scansCritical binaries and providesRisk Tier 3 Binaries Vendor scans and providesNice to Have Bill of Materials 28 28 © OpenLogic, Inc. - Licensed under CC-BY |

4. Conduct a scan or audit of your code Outcome of an OSS audit: – List of open source packages – List of open source licenses – List of license obligations (compliance checklist) – List of licenses that may have conflicting terms Options – Scanning tools – Audit services – Manual review © OpenLogic, Inc. - Licensed under CC-BY | 29

5. Develop a compliance checklist Create a compliance checklist: – Notices in code and/or documentation – Source code provided in proper way – Is there an EULA for your product? If there are conflicts or compliance is not possible: – Can you live without this code? – Is there an alternative to the code? – Can you contact the author and ask for an exception/different license? Risk management: – What is likely to get litigated? – What are your sticking points that prevent perfect compliance? © OpenLogic, Inc. - Licensed under CC-BY | 30

Thanks! Learn more – www.openlogic.com – Free resources at www.openlogic.com/downloads • Policy Builder • Whitepaper: Open Source Compliance in the Supply Chain – SPDX • www.spdx.org My contact infromation – Kim.weins@openlogic.com Follow – @openlogic – @KimAtOpenLogic 32 32 © OpenLogic, Inc. - Licensed under CC-BY |

Linux foundation automotive summit

by OpenLogic on Dec 18, 2011

Accessibility

Categories

Tags

Upload Details

Usage Rights

Statistics

Linux foundation automotive summit — Presentation Transcript